last executing test programs: 1.117689871s ago: executing program 2 (id=49): r0 = socket(0x2, 0x3, 0x88) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x0, 0x98b3}, {0x6, 0x8, 0xfd, 0x7}]}, 0x10) bind$inet(r0, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000002400)={0x2, 0x0, @multicast2}, 0x10) 1.098604736s ago: executing program 2 (id=51): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100), 0x4) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000140), 0x4) 1.081719869s ago: executing program 2 (id=53): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x6e22, 0x9, @empty, 0x8}, 0x1c) listen(r0, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200010000000000000000000a0304006e22"], 0x54}}, 0x20044010) 1.051270496s ago: executing program 2 (id=55): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = ioctl$KVM_GET_STATS_FD_cpu(r2, 0xaece) read$FUSE(r3, &(0x7f00000001c0)={0x2020}, 0x2020) 1.013945854s ago: executing program 0 (id=58): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000300)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) 947.726738ms ago: executing program 2 (id=62): r0 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r1, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) setpriority(0x2, 0xff, 0x0) 816.272756ms ago: executing program 0 (id=68): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000080)={@void, @val={0x0, 0x3, 0x1c, 0x93, 0x14, 0x6}, @ipv4=@igmp={{0x5, 0x4, 0x3, 0x8, 0x14, 0x64, 0x0, 0x3, 0x2, 0x0, @empty, @empty}, {0x11, 0x6, 0x0, @empty}}}, 0x26) 755.586189ms ago: executing program 3 (id=70): socket(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x2, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000280)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x5865, r2}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\"', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x0) 753.240769ms ago: executing program 3 (id=71): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x82f41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000d40)={@val={0xa, 0x9000}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x30, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x2, 0x0, 0x3, '\x00', {0xf, 0x6, 'V#\a', 0x6, 0x87, 0x1, @dev={0xfe, 0x80, '\x00', 0x1b}, @ipv4={'\x00', '\xff\xff', @multicast2}}}}}}}}}, 0x6a) 739.449512ms ago: executing program 0 (id=72): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0xf1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1a0, 0x0, 0x1000000}]}) 648.161621ms ago: executing program 3 (id=75): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000001840)={@void, @val={0x1, 0x3, 0x1c, 0x3, 0x14, 0x6}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x33, 0xfc0, 0x67, 0x0, 0xfd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@end]}}, "414dc1c90728557ded5995abd8c2dd746ed1b8e7b953b5e7039ee546652f979f45a699fe21e6401621d129bbfcdacc6b80371644b7d06d7ced9f49c41edcd1f2c4e5b6e13a486859035a1f0f7cf9905062e4a7d9b84398ec0a5f4018a0815fd0f9d5f5cf02964d8f9e484244f3afa2a3aac22182bf29dd83fc2bc291c8fec64be60c54e2c3a73c9474d9bbf9d6bbc1c3faf325a485fbc671a53dbab2ce05898db07fa7ed32bf943a142654fbdaeba416136f286952082afa985e3a59d21de084543dd2192156ad57f32238f6cbe9050ca5d73b9d7f9daed4d01c046abcf3439f7bd2c066f6bc259af55781ce2d10451850f2a907c9cd6db4913164efd7b47de7da19b0a98188fdc3704f55d37e22f9e18ad5ecb9fc3a2bbe85e2b488811c531f4af7831f399de76688f025b636f490a2c1140af9b62858617087f5cae53e6640e051945577ffb1e4c07bdfef5034a41a16a6162cdfd7b69330e8ce9902fc3a76f3f1bff2ea11f1c8368687653a926063831b0967480abb48f734ef8cfc15e42fb9361410d938cc9c1b304e8286220488d51488455c3f3b2c686a030bb4d64b2677a9d8aa87dbf39a278dd316db1e7d1da260c0008a256de039f851c4712db2beeed68ac56a5d925786cf0b3b12c1d2f25f0e437b188655fa6b9f5b775020754733fdb615326d945d30abc662a4933d74492c00241d2e025cba5edf85732f0d53488695aa867f1a3e74c077a543107ec5b4d1070e0ac128e2e09ed9d3087a3bc9a3eeacaa976d09b305dcfcf9e0fd14c6f4b1a0331c9382e1ca125be2643acd6c38d9873a6913af9a495e5ebab69aa7637c3704d5ed0eb7b684bff90a026bdee567d8701d543454a4ecc593a75ce070a847acd879459ff9f5671ccded94d231a60a1c1a2a4d8820dd1920f0eb66c8816467d07acce147b5b93c65f56c5f5714c96d8cf6c38ec5993e8687797f054427ae0a1f8390ee20c7fdf967a674983bee76f3982fc296d8b40b297c3c447313d05d81105949ee47e18f824860d33ad80cb8ffb3f10622551bcad32798313311e36f3a59a13c11f8df3a9bea5e95682e21eef4f01a32e3b16817830f5ab971184521c370efe8b3b17ab39caf1949c32395d20286eb2865b7191c051995a4bc0d87e1a1df8c2b474642d9d00a47b8ec249d9099b41897f0412e77384be189f3a9521d5fe2e15108d7c840ccae4e366e3382817d2de0855eebd12805da92782cfc4c69ba54916c5880f2da87a04e15c3afffbba0cacb12162c0681e58cd204e22474f3ba1416d052a6e991640febd529cc0861b6fb26f2cc922b76341b5546a103722a7083b8d69a4458c92655217c7b3fba1a9fc9116da2e0e8fe8381cde006f99f7192fcff78cd5221ab401808385a57438a9395203382bbe4fdbfd0cbe7f53f60e1cd88f94e465e828434d7334d087e375b1913032818049206c86e013ab3e54cc34eb4f1a5575091a20fd4d3cce623d734f74d36594646080083a8eb2c0a9615f5e1460204afbbb285bb6091e5c43255bade58f4be99dca47285966dec4c2a98e6bd99d935c5f39ee8d617d055b801fc9ba3f58c68d123153c0144539146ecf83652843ceb4786ceb2c6dead9bf368c5f05767fe28da6133f8b683992f12d875f46c41fee7a6990ed194416f363eaf91adcd424f7fe4024133f0c3c9a170d0308598bad014008349b0352e2658b17fe9d903e0a10d0aefe8448fbafd7d5cece702c67843560d9bd54f1a516f61b2389fa98eac264d01ee2f3acb30036f01dbbcaa5a0e62017a37742162b43d2a3e0a08ce6dc44b8713df9d090bad5638922f2d417a9da3f248df018c6e6ee29a76a25b3f5c7e77877e0c5cba1e4c1947e0b7815844519624a127d58b48e47c2504174e15a9d24c2559cb8586ac5392c4f7a8a190147f9405b778163f5de42cd51b6e198cd7d8ccbce72d0a22f731d1426dfe22bf0c93de40194bd7b2ec1b8d17b5dcbffbbd3eada2a260a2d3cb5c836aa97a4967cfe492456f1d3b0303fd3c8653af690fa985d8ee29d411461c76ca62df91cdf18faf945757ac430ee13ef938d4f351aeb279402effd2ac4f8ac8a75354fee8a42d944df98efdc96fe5ddcfc02c5ca788cd918b5983141dbadcec555186272c5abea47d79f3eb7f9349b7062c3c093d72a580012e94a6ada93cb8fbde2eb0357951269ae6cc6ba9c35f2c2ad2774d4acc0b8c0a46d231de850d3b4fe9941513ed3b5bf644d99fb79dd22785739f234114ee658418df8624955c14cb726465f91c9da2219383db4fba5ddfa19a432e04bba317a8ac0a4a7fdeae5f1ee0ba67316841c87d240d78cf19f6cbfdb76644331a0c42ed2486224b5a5ad74798adcbd1a141c0425d5d55e55d345d42489cfe3527bfc4a32b211390c19a70ea89b1ec9627a982ba9de1c8bce85eedcb8363dc2c71e71c17657a6ce9445235d04025cd29a432ee6487b4cd84732e38639abb1aee400b2cbd285ac1f57ff37f0ce299a25014c9cb7931f391e5b2fb4c22930018d5f99d0e24627b341e6f56135876fc6c8ed52d769401b2de57e2d76311ac5d188a3859f234a5d5b4b0387e5caa87be5f4f10454ee218e1a781f8d67c9d022234bfa29a62a8f73209da83cdd596864f5bce9b235066ff4f54a7874a993e097c6d3367e0e929347220e45b68b31733ca70707f58470af08c0cd6ed4c91fa958215a68de6b850fb306a32ee661012dd6fe79d786ba2678f4b5cad943ed6fc4caffce07a748ee59b28e3db92b1c62239f13e8e49a654ca5ba43852eda5c74505f7cb786eff763fa1caeceab419302f3882869b3804c55d31b1511fd65fe04c851ce4c8e7e2e09107e757a050cfb1a20c150481bd249e712c4596c5f87d3006609202b2f999a1baa30504d70128c6af0225cd0a64a832657b0ebe4200ae504c2c694d1a404f6da594d45e2de2aa7eb665aa45bcb8cda7ecc2a29e2496154e1cd7e366e71ca2d0a8652cff625de42cce24294e8f7e4617db9ce2b29c233ad401d28f8cce741c247efba5fdfde43f45776dbab2e6858d7bcff5a01be4448792868f80143d7c0b638ddc226a91e4299c7a8eab9603e2e9dcfd2a9be8070515eb83b101b0fb8cddf0bb46166ff109a8094861b1a8187d1c95216877779d387152606568f5f931614f00d4a52416004dc4a8006c2933ba377d9a4c1a9a06e17f17e7957db5a0a87bf2e9e454fcab7aada678fa50ed860aa7243dee5ccdb4d4ae12f93f0b4b2b4182c8ca9340d557606967b9b84c292a5b7c543e9c6bc2ed36eef34913de523ff181c097dfe8f80295357e9071f993f24d2fb4f55a6158d25b1a0e1971809986c8e48acf4784971e18152230b679347ab1e81b029cf711b15daa07c0ce3cfe482c8c6a7956d00021f337934afe3f1e62fcebb12630d9fde0d54750f2d58545ea4077c220a5aa505363a0321a44eed02483cbee7b6f84a3636861c69e9dc26a399d4492d33033756cd4daab72d20dd04c1edc44ef0b9bbdf63ba3e713c5cee50ff96646ca94895cd206ec89862bd6d97551796b408de07c12639247592b1513b719738779cbb64d886cf192f5577c1b2d0c4be28134400291e950aaf328f63068fa988dc065d2385f659bd04beb7d9995d2954c236ecb92c3fc27ae6cb083c59729d1bbf60988557606661e2ccb99798a43b6def2483108ce62758204ac56c27bd42ec1bbddb102a9a20cbd1b2f760157aa6656b714dd4a909b481c83c3b92c2e1452a2be07a1cf13d9235909e59c4663f15ef1e688151300d04383bfb44c595fb16a9045fa8f06df8b54feb69d1b42feb8e76485c243cfe769b1bd09fdabd6edc7547454a76ee601479430eac8ec51e97fb51f2eb6e2d099a7a9dc7e015edc4468435b40950899a236801a54ce77b46a9d74363c6aaf6ea05a997219073f145580b4064862f772613bff0dd604c119f5a0f570b214b4bd529d587443f60778a70bfc062998a4310c3af3990ba4d00fae848fbaf638dd7070d1b8fc36b4e176cbf7219521c893e29310c1d0aed8d9b67fcea66c0710a38e37f61d4eb3aa803a2206369fc24645dc827c09ed7c549adccc23f96baf18aa66d757b406fc267ba243d97231eaf7e934abf90201d4cfece387aa69913e2ac98e0502cd6d6ce737db38e5b1f6d1cf8018a8364fd3f5b9483ea78f655feba6536162f9996d703636a10ae343b6ab0a5a61e7fd8ce27383322687d5e256104bb91f44ac4f55fe27c6347e75ea2e76ffb704c3d13af4dabd20c0d82f19698b1993e86ee98772f0d91362f5e26094dbe6bb03d1418db3b707d76497216f3075cc065adbc3029eaa986ffbb73932c9a1e58920922d48ca4751c653978350ec11c4559b6caf21065fda89e00815cb5a4e7f94b0765c5a3e270c8d56c8456361230245a54525571bfbc4ec90cff3561f38be5d2bfb288812a530c5ae466de8b8d40349d7c6d327fc15738502d665b0bad1815009cb7227fff27ac01075d82696a0b58aac31d2a86fb25794840c59665f9bc78040946c20f9380561c21feec4a33f02d74f7b1eb853804b7bc413d550213c9ca9fd036fb7b49de6388d4b7139facb8854eafd2f190fa52caf613ada77a15eb11accf86805583a9b6e2a25dd67d1b78c12b7d40655faa827177f7242c05e641b207273c2e83e0f0b1b121adc46e6571fb6a36c83fe96b162dec42bec95c3d7e4b208a270f3ec6697ea587a6c59617f83b523c83b09c7cca62d0bbcdadf9082195df7d2edca76d4d68ef47e7d4b07c4feee350b0fcf74456621e3d77d4babc41a75a6e045322d1fbddee131c5630834ec7cb0c9539dcc09ada86dba4374115078345511b96c33a1e68233876620a7f2aff2c0da846e5eb3d3f18c08966e485e33981dbdf3a357488b0e1452b3c56e703e56b736b2bad4a4b94083c8568e87ea85df59cb840b34a71b2748e80d41ff39e7038154b775b4db18887b67bea223f2b4bdffe40031eede920f370ca46cb6cc273f20cec5d571407277a610d7d339a037a4bbee23da4ab3f165be0ed7a2ab05b87d826b0d30587546ac26f55d93f2f0b1809da0f865721ae38866990e42a60e9003f7b4f1c5f2142dcb69ce659bd060368778f4022fe484ec67063bd5446baa1502cbe15a60ba50e83984d6df1127ee8001c07698c3867c1dcbb90446adc177ca75506ae2e3ddc68fb8951b648f05eebd0d0edd121ee51dd0003ff00a3085d5a613a10532c0cb0d2ac78b4852c06f26875f681d35c3966b4129bad16bf8914aa4d8de43140e9e1c341cde07a9d2fd2cce6a52e0bfc46004696887f1b00e628a335ca62cf38121a72d1dfead99c7138189f1cff37cb7682e9c29fd548d5443d97d61efd28c6fe34673161c907203077e4c68d48cefbf0e77a2359794d47b133b77871fd9a6775b962eb678945ef9df48afb580f123c1cd3fadd3f8982e585e7a459b7ecdb9080b9ec945c34011b0a057295dfc5fb94a008d8257f1463536525c72ee5c7f49fdd80b9b6bd948fb34a886ca87758dca9870c56bfa54601cc56946a4236e43742e74e95ae2f6a59a0a85a52ad218c15dcf4a74b1e8320174c50e88a3e1d54ae6d9ea8b4bdbbd1acf9bb39f339ee68fcfa994a29c1e46089459856d15bc6a78eca909fc8c2401371d16bdacc04bb82376"}}, 0xfca) 469.92655ms ago: executing program 0 (id=77): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 440.876076ms ago: executing program 1 (id=78): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") ioctl(r0, 0xc138fd0e, &(0x7f0000000000)) 415.320941ms ago: executing program 1 (id=79): newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r0, r0, 0x0) r1 = getpid() r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r1, 0x7, 0xffffffffffffffff, 0x0) 360.241903ms ago: executing program 1 (id=80): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000140)={0x0, 0x7217, 0x4000, 0x3, 0x21f}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecc7, 0x20000, 0x2, 0x28e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf9a, 0x1248, 0x1200, 0xe3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x8000, 0x2, 0xf6, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec21, 0x100, 0x3, 0x18f}}], 0x4, 0x0, 0x0) 321.749241ms ago: executing program 1 (id=81): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x1, 0xffff1000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000f4e000/0x3000)=nil}) 307.781784ms ago: executing program 3 (id=82): ioperm(0x4, 0x8, 0x5) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000005b000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200004ffc000) 258.668835ms ago: executing program 3 (id=83): mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') 233.63692ms ago: executing program 2 (id=84): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) 233.10061ms ago: executing program 3 (id=85): r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) 215.086784ms ago: executing program 1 (id=86): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) sendfile(r1, r1, 0x0, 0x38c6) 98.639409ms ago: executing program 0 (id=87): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x262) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0xc, {0x2, 0x0, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x3a, {0x2, 0x2, @broadcast}, 'geneve1\x00'}) 515.01µs ago: executing program 1 (id=88): writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058", 0x1f}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x200002e6) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x312000, 0x800, 0x0, 0x5}, 0x20) 0s ago: executing program 0 (id=89): r0 = userfaultfd(0x80001) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.4' (ED25519) to the list of known hosts. [ 31.112548][ T36] audit: type=1400 audit(1790858007.380:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 31.117125][ T286] cgroup: Unknown subsys name 'net' [ 31.135456][ T36] audit: type=1400 audit(1790858007.380:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.164146][ T36] audit: type=1400 audit(1790858007.410:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.164707][ T286] cgroup: Unknown subsys name 'devices' [ 31.274217][ T286] cgroup: Unknown subsys name 'hugetlb' [ 31.279886][ T286] cgroup: Unknown subsys name 'rlimit' [ 31.399057][ T36] audit: type=1400 audit(1790858007.660:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.422363][ T36] audit: type=1400 audit(1790858007.660:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 31.447485][ T36] audit: type=1400 audit(1790858007.660:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 31.479187][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 31.488109][ T36] audit: type=1400 audit(1790858007.750:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.513020][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.513723][ T36] audit: type=1400 audit(1790858007.750:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.548131][ T36] audit: type=1400 audit(1790858007.770:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.573839][ T36] audit: type=1400 audit(1790858007.770:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 32.720339][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.727576][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.734807][ T296] bridge_slave_0: entered allmulticast mode [ 32.741209][ T296] bridge_slave_0: entered promiscuous mode [ 32.755216][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.762592][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.769875][ T294] bridge_slave_0: entered allmulticast mode [ 32.776421][ T294] bridge_slave_0: entered promiscuous mode [ 32.783170][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.790256][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.797442][ T296] bridge_slave_1: entered allmulticast mode [ 32.803938][ T296] bridge_slave_1: entered promiscuous mode [ 32.819074][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.826208][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.833531][ T294] bridge_slave_1: entered allmulticast mode [ 32.839863][ T294] bridge_slave_1: entered promiscuous mode [ 32.877713][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.884844][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.892286][ T293] bridge_slave_0: entered allmulticast mode [ 32.898760][ T293] bridge_slave_0: entered promiscuous mode [ 32.909650][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.916809][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.924160][ T293] bridge_slave_1: entered allmulticast mode [ 32.930829][ T293] bridge_slave_1: entered promiscuous mode [ 32.980608][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.987772][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.994936][ T295] bridge_slave_0: entered allmulticast mode [ 33.001399][ T295] bridge_slave_0: entered promiscuous mode [ 33.019624][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.026800][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.034171][ T295] bridge_slave_1: entered allmulticast mode [ 33.040466][ T295] bridge_slave_1: entered promiscuous mode [ 33.166966][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.174094][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.181887][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.189296][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.215141][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.222244][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.229580][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.236800][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.266722][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.274929][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.282743][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.289885][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.326198][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.333327][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.340683][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.347859][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.357329][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.365006][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.372423][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.380074][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.387768][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.395201][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.402583][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.409992][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.433825][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.440913][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.448612][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.455707][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.489413][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.496516][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.511640][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.518945][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.526872][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.533975][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.555093][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.562178][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.586857][ T294] veth0_vlan: entered promiscuous mode [ 33.609835][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.617027][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.625806][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.632990][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.658682][ T294] veth1_macvtap: entered promiscuous mode [ 33.667856][ T293] veth0_vlan: entered promiscuous mode [ 33.707422][ T296] veth0_vlan: entered promiscuous mode [ 33.714962][ T293] veth1_macvtap: entered promiscuous mode [ 33.744781][ T296] veth1_macvtap: entered promiscuous mode [ 33.755869][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 33.797463][ T295] veth0_vlan: entered promiscuous mode [ 33.816017][ T312] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 33.844766][ T295] veth1_macvtap: entered promiscuous mode [ 33.980304][ T330] SELinux: Context #! ./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 33.981764][ T330] UHID_CREATE from different security context by process 5 (syz.3.8), this is not allowed. [ 34.200156][ T350] MTRR 1 not used [ 34.221255][ T354] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:ac14:1419 with DS=0x33 [ 34.259659][ T9] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 34.300129][ T9] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 34.526098][ T379] FAULT_INJECTION: forcing a failure. [ 34.526098][ T379] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 34.556638][ T379] CPU: 0 UID: 0 PID: 379 Comm: syz.0.32 Not tainted syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 [ 34.556665][ T379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 34.556717][ T379] Call Trace: [ 34.556723][ T379] [ 34.556730][ T379] __dump_stack+0x21/0x30 [ 34.556772][ T379] dump_stack_lvl+0x140/0x1c0 [ 34.556797][ T379] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.556822][ T379] ? check_stack_object+0x10f/0x150 [ 34.556842][ T379] dump_stack+0x19/0x20 [ 34.556865][ T379] should_fail_ex+0x3c2/0x510 [ 34.556888][ T379] should_fail+0xf/0x20 [ 34.556907][ T379] should_fail_usercopy+0x1e/0x30 [ 34.556930][ T379] _copy_from_user+0x20/0xa0 [ 34.556955][ T379] copy_clone_args_from_user+0x20c/0x740 [ 34.556982][ T379] ? futex_wait+0x2b8/0x7c0 [ 34.556998][ T379] ? __delayed_free_task+0x40/0x40 [ 34.557034][ T379] __se_sys_clone3+0x143/0x360 [ 34.557066][ T379] ? do_futex+0x32a/0x510 [ 34.557094][ T379] ? __x64_sys_clone3+0x80/0x80 [ 34.557125][ T379] ? __se_sys_futex+0x13c/0x320 [ 34.557154][ T379] ? fput+0x1a4/0x230 [ 34.557194][ T379] ? __kasan_check_write+0x18/0x20 [ 34.557218][ T379] __x64_sys_clone3+0x5f/0x80 [ 34.557246][ T379] x64_sys_call+0x28fc/0x2ee0 [ 34.557266][ T379] do_syscall_64+0x57/0xf0 [ 34.557288][ T379] ? clear_bhb_loop+0x50/0xa0 [ 34.557317][ T379] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.557344][ T379] RIP: 0033:0x7f1e7619e159 [ 34.557369][ T379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.557387][ T379] RSP: 002b:00007f1e77050ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 34.557417][ T379] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f1e7619e159 [ 34.557433][ T379] RDX: 00007f1e77050f10 RSI: 0000000000000058 RDI: 00007f1e77050f10 [ 34.557445][ T379] RBP: 00007f1e7623506b R08: 0000000000000000 R09: 0000000000000058 [ 34.557460][ T379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.557474][ T379] R13: 00007f1e76426038 R14: 00007f1e76425fa0 R15: 00007ffcfb0f2b78 [ 34.557489][ T379]                                                                                                                                                                                                                                                                                    [ 36.084468][ T294] ================================================================== [ 36.092678][ T294] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 36.099008][ T294] Write of size 4 at addr 0000000000000168 by task syz-executor/294 [ 36.107025][ T294] [ 36.109383][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Tainted: G W syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 [ 36.109422][ T294] Tainted: [W]=WARN [ 36.109430][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.109445][ T294] Call Trace: [ 36.109454][ T294] [ 36.109463][ T294] __dump_stack+0x21/0x30 [ 36.109503][ T294] dump_stack_lvl+0x140/0x1c0 [ 36.109537][ T294] ? __cfi_dump_stack_lvl+0x10/0x10 [ 36.109573][ T294] print_report+0x3d/0x70 [ 36.109606][ T294] kasan_report+0x162/0x1a0 [ 36.109638][ T294] ? ihold+0x24/0x70 [ 36.109668][ T294] ? ihold+0x24/0x70 [ 36.109697][ T294] kasan_check_range+0x25a/0x2b0 [ 36.109729][ T294] __kasan_check_write+0x18/0x20 [ 36.109754][ T294] ihold+0x24/0x70 [ 36.109782][ T294] vfs_rmdir+0x25c/0x560 [ 36.109817][ T294] incfs_kill_sb+0x102/0x220 [ 36.109850][ T294] deactivate_locked_super+0xd5/0x270 [ 36.109886][ T294] deactivate_super+0xb8/0xe0 [ 36.109928][ T294] cleanup_mnt+0x438/0x4d0 [ 36.109959][ T294] __cleanup_mnt+0x1d/0x40 [ 36.109988][ T294] task_work_run+0x1e5/0x260 [ 36.110021][ T294] ? __cfi_task_work_run+0x10/0x10 [ 36.110051][ T294] ? __x64_sys_umount+0x12e/0x180 [ 36.110074][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 36.110097][ T294] ? __kasan_check_read+0x15/0x20 [ 36.110121][ T294] resume_user_mode_work+0x35/0x50 [ 36.110144][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 36.110180][ T294] do_syscall_64+0x63/0xf0 [ 36.110203][ T294] ? clear_bhb_loop+0x50/0xa0 [ 36.110236][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.110267][ T294] RIP: 0033:0x7fa43fb9f397 [ 36.110288][ T294] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 36.110308][ T294] RSP: 002b:00007ffeb9ff7938 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 36.110333][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fa43fb9f397 [ 36.110349][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeb9ff79f0 [ 36.110365][ T294] RBP: 00007ffeb9ff79f0 R08: 00007ffeb9ff89f0 R09: 00000000ffffffff [ 36.110382][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeb9ff8a80 [ 36.110398][ T294] R13: 00007fa43fc344bb R14: 0000000000008bdd R15: 00007ffeb9ff8ac0 [ 36.110419][ T294] [ 36.110427][ T294] ================================================================== [ 36.353714][ T294] Disabling lock debugging due to kernel taint [ 36.360153][ T294] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 36.368013][ T294] #PF: supervisor write access in kernel mode [ 36.374143][ T294] #PF: error_code(0x0002) - not-present page syzkaller[ 36.380164][ T294] PGD 800000010d3f7067 P4D 800000010d3f7067 PUD 0 syzkaller log[ 36.387493][ T294] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 36.391001][ T36] kauditd_printk_skb: 138 callbacks suppressed [ 36.391044][ T36] audit: type=1400 audit(1790858012.650:212): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 36.394859][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Tainted: G B W syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 [ 36.394897][ T294] Tainted: [B]=BAD_PAGE, [W]=WARN [ 36.394906][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 36.401508][ T36] audit: type=1400 audit(1790858012.650:213): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.422852][ T294] RIP: 0010:ihold+0x2a/0x70 [ 36.422896][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 fd 17 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 0d [ 36.422915][ T294] RSP: 0018:ffffc9000b69fcc8 EFLAGS: 00010246 [ 36.422935][ T294] RAX: ffff888101fd0000 RBX: 0000000000000000 RCX: ffff888101fd0000 [ 36.437572][ T36] audit: type=1400 audit(1790858012.650:214): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.441072][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 36.451746][ T36] audit: type=1400 audit(1790858012.650:215): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.472399][ T294] RBP: ffffc9000b69fcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 [ 36.472421][ T294] R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 [ 36.472437][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 36.472452][ T294] FS: 000055555742e500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 36.472472][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.478356][ T36] audit: type=1400 audit(1790858012.650:216): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.496587][ T294] CR2: 0000000000000168 CR3: 0000000102350000 CR4: 00000000003526b0 [ 36.496611][ T294] Call Trace: [ 36.496619][ T294] [ 36.496629][ T294] vfs_rmdir+0x25c/0x560 [ 36.503902][ T36] audit: type=1400 audit(1790858012.650:217): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.510712][ T294] incfs_kill_sb+0x102/0x220 [ 36.532823][ T36] audit: type=1400 audit(1790858012.650:218): avc: denied { getattr } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.539963][ T294] deactivate_locked_super+0xd5/0x270 [ 36.694841][ T294] deactivate_super+0xb8/0xe0 [ 36.699538][ T294] cleanup_mnt+0x438/0x4d0 [ 36.703967][ T294] __cleanup_mnt+0x1d/0x40 [ 36.708392][ T294] task_work_run+0x1e5/0x260 [ 36.713099][ T294] ? __cfi_task_work_run+0x10/0x10 [ 36.718222][ T294] ? __x64_sys_umount+0x12e/0x180 [ 36.723270][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 36.728649][ T294] ? __kasan_check_read+0x15/0x20 [ 36.733862][ T294] resume_user_mode_work+0x35/0x50 [ 36.739158][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 36.744713][ T294] do_syscall_64+0x63/0xf0 [ 36.749164][ T294] ? clear_bhb_loop+0x50/0xa0 [ 36.753941][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.759842][ T294] RIP: 0033:0x7fa43fb9f397 [ 36.764334][ T294] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 36.784055][ T294] RSP: 002b:00007ffeb9ff7938 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 36.792778][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fa43fb9f397 [ 36.801303][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeb9ff79f0 [ 36.809731][ T294] RBP: 00007ffeb9ff79f0 R08: 00007ffeb9ff89f0 R09: 00000000ffffffff [ 36.817725][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeb9ff8a80 [ 36.826399][ T294] R13: 00007fa43fc344bb R14: 0000000000008bdd R15: 00007ffeb9ff8ac0 [ 36.834393][ T294] [ 36.837448][ T294] Modules linked in: [ 36.841357][ T294] CR2: 0000000000000168 [ 36.845516][ T294] ---[ end trace 0000000000000000 ]--- [ 36.851160][ T294] RIP: 0010:ihold+0x2a/0x70 [ 36.855754][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 fd 17 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 0d [ 36.877775][ T294] RSP: 0018:ffffc9000b69fcc8 EFLAGS: 00010246 [ 36.883878][ T294] RAX: ffff888101fd0000 RBX: 0000000000000000 RCX: ffff888101fd0000 [ 36.891870][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 36.899880][ T294] RBP: ffffc9000b69fcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 [ 36.907901][ T294] R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 [ 36.915896][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 36.923888][ T294] FS: 000055555742e500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 36.932832][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.939439][ T294] CR2: 0000000000000168 CR3: 0000000102350000 CR4: 00000000003526b0 [ 36.947609][ T294] Kernel panic - not syncing: Fatal exception [ 36.953921][ T294] Kernel Offset: disabled [ 36.958425][ T294] Rebooting in 86400 seconds..